CVE-2021-38197
📋 TL;DR
This vulnerability in go-unarr 0.1.1 allows attackers to perform directory traversal attacks via specially crafted TAR archives containing '../' sequences in pathnames. When exploited, it enables arbitrary file write outside the intended extraction directory. Any application using go-unarr to extract untrusted TAR archives is affected.
💻 Affected Systems
- go-unarr (Go bindings for unarr)
📦 What is this software?
Go Unarr by Go Unarr Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file overwrite of critical system files, potentially leading to remote code execution, privilege escalation, or data destruction.
Likely Case
Arbitrary file write to sensitive locations, potentially overwriting configuration files, web content, or user data.
If Mitigated
Limited to extraction directory if proper sandboxing or validation is implemented.
🎯 Exploit Status
Exploitation requires only a malicious TAR archive; no authentication needed if application processes untrusted archives.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.2 or later
Vendor Advisory: https://github.com/gen2brain/go-unarr/issues/21
Restart Required: No
Instructions:
1. Update go-unarr dependency to version 0.1.2 or later. 2. Run 'go get -u github.com/gen2brain/go-unarr'. 3. Rebuild and redeploy affected applications.
🔧 Temporary Workarounds
Input validation before extraction
allValidate archive paths before extraction to reject any containing '../' sequences.
Sandbox extraction directory
allExtract archives to isolated, non-privileged directories with restricted permissions.
🧯 If You Can't Patch
- Implement strict input validation to reject TAR archives with path traversal sequences.
- Run extraction processes with minimal privileges and in isolated environments.
🔍 How to Verify
Check if Vulnerable:
Check if application uses go-unarr version 0.1.1 via 'go list -m all | grep go-unarr' or inspect go.mod/go.sum files.Check Version:
go list -m all | grep go-unarrVerify Fix Applied:
Verify go-unarr version is 0.1.2 or later using 'go list -m all | grep go-unarr'.📡 Detection & Monitoring
Log Indicators:
- Failed file write attempts outside expected directories
- Unusual file paths in extraction logs
Network Indicators:
- Inbound TAR archive uploads followed by file system activity outside expected locations
SIEM Query:
source="application_logs" AND ("../" OR "directory traversal" OR "path traversal")